Null Pointer Dereference in Feathersjs with Api Keys

A null pointer dereference in a FeathersJS service becomes high risk when Api Keys are used for authentication but the implementation does not validate the presence or ownership of the key before accessing object properties. In Feathers, a typical pattern is to locate a service hook that reads an apiKey from the request headers, look up the associated record, and then continue processing. If the lookup returns null or undefined and the code proceeds to dereference the result, the runtime throws a null pointer exception. This can expose stack traces or cause the HTTP handler to crash, leading to information leakage or denial of service.

Consider a Feathers service defined with feathers-sequelize or feathers-mongoose. A developer might write an after hook that assumes the key exists:

// Risky after hook that can trigger a null pointer dereference
app.service('reports').hooks({
  after: {
    async find(context) {
      const { apiKey } = context.params.headers;
      const keyRecord = await context.app.service('api-keys').get(apiKey);
      // If get() returns null and keyRecord is used directly, dereferencing throws
      context.result.data.ownerId = keyRecord.userId;
      return context;
    }
  }
});

If keyRecord is null, accessing keyRecord.userId causes a null pointer dereference. In production, this may manifest as a 500 error or an unhandled exception. An attacker can probe the endpoint with arbitrary or missing Api Keys to confirm the behavior and potentially cause service instability. Because the scan includes Authentication and BOLA/IDOR checks, it can flag cases where authorization checks are incomplete or where the application does not gracefully handle missing entities. The same issue can arise when iterating over collections derived from a key lookup without a null guard.

Another scenario involves configuration objects that are expected to be present but are omitted by the client. For example, if a hook reads context.params.provider or nested properties without verifying existence, a null pointer can propagate into downstream integrations. The scanner’s Input Validation and Property Authorization checks are designed to surface these weak guard clauses, especially when combined with Api Keys that are expected to gate access to sensitive operations.

Remediation focuses on validating the Api Key and its associated data before any property access. Always check for null or undefined and return a clean, authorized error response instead of allowing a dereference to occur. Below are two concrete, syntactically correct FeathersJS examples demonstrating safe patterns.

1. Safe lookup with null handling in an after hook

// Safe after hook with explicit null checks
app.service('reports').hooks({
  after: {
    async find(context) {
      const apiKey = context.params.headers?.apiKey;
      if (!apiKey) {
        throw new Error('Unauthorized: Missing Api Key');
      }

      const keyRecord = await context.app.service('api-keys').get(apiKey).catch(() => null);
      if (!keyRecord) {
        throw new Error('Unauthorized: Invalid Api Key');
      }

      // Safe dereference after validation
      context.result.data.ownerId = keyRecord.userId;
      context.result.data.scopes = keyRecord.scopes || [];
      return context;
    }
  }
});

2. Guarded access in a before hook with explicit error responses

// Before hook that validates Api Key and enriches context safely
app.service('projects').hooks({
  before: {
    async create(context) {
      const apiKey = context.params.headers?.apiKey;
      if (!apiKey) {
        throw new Error('Unauthorized: Missing Api Key');
      }

      const keyRecord = await context.app.service('api-keys').get(apiKey).catch(() => null);
      if (!keyRecord || keyRecord.revoked) {
        throw new Error('Unauthorized: Invalid or revoked Api Key');
      }

      // Ensure properties exist before using them
      context.data.createdBy = keyRecord.userId ?? 'unknown';
      context.data.teamId = keyRecord.teamId ?? null;
      return context;
    }
  }
});

These patterns ensure that the Api Key is present, valid, and mapped to an existing entity before any property dereference occurs. They align with the scanner’s checks for Authentication and BOLA/IDOR by enforcing strict ownership and validity checks. The use of optional chaining (?.) and explicit fallbacks reduces the likelihood of null pointer conditions in nested property access. When combined with the Pro plan’s continuous monitoring, these fixes help maintain a stable risk score and provide timely alerts if new issues appear across monitored APIs.

Additionally, leveraging the CLI (middlebrick scan <url>) or the GitHub Action to integrate these checks into CI/CD can prevent regressions. The MCP Server allows you to validate Api Key handling directly from your IDE while you code, catching null pointer risks before they reach production.